subprocessors data sharing · Privacy Policy
Toma policy finding
“ With respect to personal information collected from Chat Users through the Web Chat embedded on a dealer's website, the dealer (not Toma) acts as the data controller. Toma processes this personal information on behalf of, and at the direction of, the applicable dealer as a service provider (or "processor"). As a service provider under the CCPA/CPRA, Toma is contractually prohibited from retaining, using, or disclosing Chat User personal information for any purpose other than the specific business purposes set forth in our agreement with the dealer, or outside the direct business relationship between Toma and the dealer. Toma does not combine Chat User personal information received from one dealer with personal information received from other dealers or from other sources, except as permitted by applicable law. Dealers are responsible for complying with all applicable data-privacy and data-protection laws, including providing required notices and obtaining required consents from Chat Users. Chat Users should refer to the privacy policy of the applicable dealer to understand how their personal information is processed by the dealer.”
- Document
- Privacy Policy
- Captured
- 2026-09-25
- Location
- § 12 (Dealer as Data Controller)
- Snapshot SHA-256
- ee6db86de399d544b9c9fbe9dc9963e60143ab9638a52f09c7d90d61da51630d
Informational only, not legal advice. Terms change; verify the source and capture date.